summaryrefslogtreecommitdiff
path: root/docs/htmldocs/unix-permissions.html
blob: 153a0e82bc4d5dff14ca5f3aa73df22837b34837 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<HTML
><HEAD
><TITLE
>UNIX Permission Bits and Windows NT Access Control Lists</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.77"><LINK
REL="HOME"
TITLE="SAMBA Project Documentation"
HREF="samba-howto-collection.html"><LINK
REL="UP"
TITLE="Optional configuration"
HREF="p1346.html"><LINK
REL="PREVIOUS"
TITLE="Integrating MS Windows networks with Samba"
HREF="integrate-ms-networks.html"><LINK
REL="NEXT"
TITLE="Configuring PAM for distributed but centrally 
managed authentication"
HREF="pam.html"></HEAD
><BODY
CLASS="CHAPTER"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>SAMBA Project Documentation</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="integrate-ms-networks.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="pam.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="CHAPTER"
><H1
><A
NAME="UNIX-PERMISSIONS"
></A
>Chapter 11. UNIX Permission Bits and Windows NT Access Control Lists</H1
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1593"
></A
>11.1. Viewing and changing UNIX permissions using the NT 
	security dialogs</H1
><P
>New in the Samba 2.0.4 release is the ability for Windows 
	NT clients to use their native security settings dialog box to 
	view and modify the underlying UNIX permissions.</P
><P
>Note that this ability is careful not to compromise 
	the security of the UNIX host Samba is running on, and 
	still obeys all the file permission rules that a Samba 
	administrator can set.</P
><P
>In Samba 2.0.4 and above the default value of the 
	parameter <A
HREF="smb.conf.5.html#NTACLSUPPORT"
TARGET="_top"
><TT
CLASS="PARAMETER"
><I
>	nt acl support</I
></TT
></A
> has been changed from 
	<TT
CLASS="CONSTANT"
>false</TT
> to <TT
CLASS="CONSTANT"
>true</TT
>, so 
 	manipulation of permissions is turned on by default.</P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1602"
></A
>11.2. How to view file security on a Samba share</H1
><P
>From an NT 4.0 client, single-click with the right 
	mouse button on any file or directory in a Samba mounted 
	drive letter or UNC path. When the menu pops-up, click 
	on the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Properties</I
></SPAN
> entry at the bottom of 
	the menu. This brings up the normal file properties dialog
	box, but with Samba 2.0.4 this will have a new tab along the top
	marked <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Security</I
></SPAN
>. Click on this tab and you 
	will see three buttons, <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Permissions</I
></SPAN
>, 	
	<SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Auditing</I
></SPAN
>, and <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Ownership</I
></SPAN
>. 
	The <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Auditing</I
></SPAN
> button will cause either 
	an error message <SPAN
CLASS="ERRORNAME"
>A requested privilege is not held 
	by the client</SPAN
> to appear if the user is not the 
	NT Administrator, or a dialog which is intended to allow an 
	Administrator to add auditing requirements to a file if the 
	user is logged on as the NT Administrator. This dialog is 
	non-functional with a Samba share at this time, as the only 
	useful button, the <B
CLASS="COMMAND"
>Add</B
> button will not currently 
	allow a list of users to be seen.</P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1613"
></A
>11.3. Viewing file ownership</H1
><P
>Clicking on the <B
CLASS="COMMAND"
>"Ownership"</B
> button 
	brings up a dialog box telling you who owns the given file. The 
	owner name will be of the form :</P
><P
><B
CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
>Where <TT
CLASS="REPLACEABLE"
><I
>SERVER</I
></TT
> is the NetBIOS name of 
	the Samba server, <TT
CLASS="REPLACEABLE"
><I
>user</I
></TT
> is the user name of 
	the UNIX user who owns the file, and <TT
CLASS="REPLACEABLE"
><I
>(Long name)</I
></TT
>
	is the descriptive string identifying the user (normally found in the
	GECOS field of the UNIX password database). Click on the <B
CLASS="COMMAND"
>Close
	</B
> button to remove this dialog.</P
><P
>If the parameter <TT
CLASS="PARAMETER"
><I
>nt acl support</I
></TT
>
	is set to <TT
CLASS="CONSTANT"
>false</TT
> then the file owner will 
	be shown as the NT user <B
CLASS="COMMAND"
>"Everyone"</B
>.</P
><P
>The <B
CLASS="COMMAND"
>Take Ownership</B
> button will not allow 
	you to change the ownership of this file to yourself (clicking on 
	it will display a dialog box complaining that the user you are 
	currently logged onto the NT client cannot be found). The reason 
	for this is that changing the ownership of a file is a privileged 
	operation in UNIX, available only to the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>root</I
></SPAN
> 
	user. As clicking on this button causes NT to attempt to change 
	the ownership of a file to the current user logged into the NT 
	client this will not work with Samba at this time.</P
><P
>There is an NT chown command that will work with Samba 
	and allow a user with Administrator privilege connected 
	to a Samba 2.0.4 server as root to change the ownership of 
	files on both a local NTFS filesystem or remote mounted NTFS 
	or Samba drive. This is available as part of the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Seclib
	</I
></SPAN
> NT security library written by Jeremy Allison of 
	the Samba Team, available from the main Samba ftp site.</P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1633"
></A
>11.4. Viewing file or directory permissions</H1
><P
>The third button is the <B
CLASS="COMMAND"
>"Permissions"</B
> 
	button. Clicking on this brings up a dialog box that shows both 
	the permissions and the UNIX owner of the file or directory. 
	The owner is displayed in the form :</P
><P
><B
CLASS="COMMAND"
>"SERVER\user (Long name)"</B
></P
><P
>Where <TT
CLASS="REPLACEABLE"
><I
>SERVER</I
></TT
> is the NetBIOS name of 
	the Samba server, <TT
CLASS="REPLACEABLE"
><I
>user</I
></TT
> is the user name of 
	the UNIX user who owns the file, and <TT
CLASS="REPLACEABLE"
><I
>(Long name)</I
></TT
>
	is the descriptive string identifying the user (normally found in the
	GECOS field of the UNIX password database).</P
><P
>If the parameter <TT
CLASS="PARAMETER"
><I
>nt acl support</I
></TT
>
	is set to <TT
CLASS="CONSTANT"
>false</TT
> then the file owner will 
	be shown as the NT user <B
CLASS="COMMAND"
>"Everyone"</B
> and the 
	permissions will be shown as NT "Full Control".</P
><P
>The permissions field is displayed differently for files 
	and directories, so I'll describe the way file permissions 
	are displayed first.</P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1648"
></A
>11.4.1. File Permissions</H2
><P
>The standard UNIX user/group/world triple and 
		the corresponding "read", "write", "execute" permissions 
		triples are mapped by Samba into a three element NT ACL 
		with the 'r', 'w', and 'x' bits mapped into the corresponding 
		NT permissions. The UNIX world permissions are mapped into 
		the global NT group <B
CLASS="COMMAND"
>Everyone</B
>, followed 
		by the list of permissions allowed for UNIX world. The UNIX 
		owner and group permissions are displayed as an NT 
		<B
CLASS="COMMAND"
>user</B
> icon and an NT <B
CLASS="COMMAND"
>local 
		group</B
> icon respectively followed by the list 
	 	of permissions allowed for the UNIX user and group.</P
><P
>As many UNIX permission sets don't map into common 
		NT names such as <B
CLASS="COMMAND"
>"read"</B
>, <B
CLASS="COMMAND"
>		"change"</B
> or <B
CLASS="COMMAND"
>"full control"</B
> then 
		usually the permissions will be prefixed by the words <B
CLASS="COMMAND"
>		"Special Access"</B
> in the NT display list.</P
><P
>But what happens if the file has no permissions allowed 
		for a particular UNIX user group or world component ? In order 
		to  allow "no permissions" to be seen and modified then Samba 
		overloads the NT <B
CLASS="COMMAND"
>"Take Ownership"</B
> ACL attribute 
		(which has no meaning in UNIX) and reports a component with 
		no permissions as having the NT <B
CLASS="COMMAND"
>"O"</B
> bit set. 
		This was chosen of course to make it look like a zero, meaning 
		zero permissions. More details on the decision behind this will 
		be given below.</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="AEN1662"
></A
>11.4.2. Directory Permissions</H2
><P
>Directories on an NT NTFS file system have two 
		different sets of permissions. The first set of permissions 
		is the ACL set on the directory itself, this is usually displayed 
		in the first set of parentheses in the normal <B
CLASS="COMMAND"
>"RW"</B
> 
		NT style. This first set of permissions is created by Samba in 
		exactly the same way as normal file permissions are, described 
		above, and is displayed in the same way.</P
><P
>The second set of directory permissions has no real meaning 
		in the UNIX permissions world and represents the <B
CLASS="COMMAND"
>		"inherited"</B
> permissions that any file created within 
		this directory would inherit.</P
><P
>Samba synthesises these inherited permissions for NT by 
		returning as an NT ACL the UNIX permission mode that a new file 
		created by Samba on this share would receive.</P
></DIV
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1669"
></A
>11.5. Modifying file or directory permissions</H1
><P
>Modifying file and directory permissions is as simple 
	as changing the displayed permissions in the dialog box, and 
	clicking the <B
CLASS="COMMAND"
>OK</B
> button. However, there are 
	limitations that a user needs to be aware of, and also interactions 
	with the standard Samba permission masks and mapping of DOS 
	attributes that need to also be taken into account.</P
><P
>If the parameter <TT
CLASS="PARAMETER"
><I
>nt acl support</I
></TT
>
	is set to <TT
CLASS="CONSTANT"
>false</TT
> then any attempt to set 
	security permissions will fail with an <B
CLASS="COMMAND"
>"Access Denied"
	</B
> message.</P
><P
>The first thing to note is that the <B
CLASS="COMMAND"
>"Add"</B
> 
	button will not return a list of users in Samba 2.0.4 (it will give 
	an error message of <B
CLASS="COMMAND"
>"The remote procedure call failed 
	and did not execute"</B
>). This means that you can only 
	manipulate the current user/group/world permissions listed in 
	the dialog box. This actually works quite well as these are the 
	only permissions that UNIX actually has.</P
><P
>If a permission triple (either user, group, or world) 
	is removed from the list of permissions in the NT dialog box, 
	then when the <B
CLASS="COMMAND"
>"OK"</B
> button is pressed it will 
	be applied as "no permissions" on the UNIX side. If you then 
	view the permissions again the "no permissions" entry will appear 
	as the NT <B
CLASS="COMMAND"
>"O"</B
> flag, as described above. This 
	allows you to add permissions back to a file or directory once 
	you have removed them from a triple component.</P
><P
>As UNIX supports only the "r", "w" and "x" bits of 
	an NT ACL then if other NT security attributes such as "Delete 
	access" are selected then they will be ignored when applied on 
	the Samba server.</P
><P
>When setting permissions on a directory the second 
	set of permissions (in the second set of parentheses) is 
	by default applied to all files within that directory. If this 
	is not what you want you must uncheck the <B
CLASS="COMMAND"
>"Replace 
	permissions on existing files"</B
> checkbox in the NT 
	dialog before clicking <B
CLASS="COMMAND"
>"OK"</B
>.</P
><P
>If you wish to remove all permissions from a 
	user/group/world  component then you may either highlight the 
	component and click the <B
CLASS="COMMAND"
>"Remove"</B
> button, 
	or set the component to only have the special <B
CLASS="COMMAND"
>"Take
	Ownership"</B
> permission (displayed as <B
CLASS="COMMAND"
>"O"
	</B
>) highlighted.</P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1691"
></A
>11.6. Interaction with the standard Samba create mask 
	parameters</H1
><P
>Note that with Samba 2.0.5 there are four new parameters 
	to control this interaction.  These are :</P
><P
><TT
CLASS="PARAMETER"
><I
>security mask</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force security mode</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>directory security mask</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force directory security mode</I
></TT
></P
><P
>Once a user clicks <B
CLASS="COMMAND"
>"OK"</B
> to apply the 
	permissions Samba maps the given permissions into a user/group/world 
	r/w/x triple set, and then will check the changed permissions for a 
	file against the bits set in the <A
HREF="smb.conf.5.html#SECURITYMASK"
TARGET="_top"
> 
	<TT
CLASS="PARAMETER"
><I
>security mask</I
></TT
></A
> parameter. Any bits that 
	were changed that are not set to '1' in this parameter are left alone 
	in the file permissions.</P
><P
>Essentially, zero bits in the <TT
CLASS="PARAMETER"
><I
>security mask</I
></TT
>
	mask may be treated as a set of bits the user is <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>not</I
></SPAN
> 
	allowed to change, and one bits are those the user is allowed to change.
	</P
><P
>If not set explicitly this parameter is set to the same value as 
	the <A
HREF="smb.conf.5.html#CREATEMASK"
TARGET="_top"
><TT
CLASS="PARAMETER"
><I
>create mask
	</I
></TT
></A
> parameter to provide compatibility with Samba 2.0.4 
	where this permission change facility was introduced. To allow a user to 
	modify all the user/group/world permissions on a file, set this parameter 
	to 0777.</P
><P
>Next Samba checks the changed permissions for a file against 
	the bits set in the <A
HREF="smb.conf.5.html#FORCESECURITYMODE"
TARGET="_top"
>	<TT
CLASS="PARAMETER"
><I
>force security mode</I
></TT
></A
> parameter. Any bits 
	that were changed that correspond to bits set to '1' in this parameter 
	are forced to be set.</P
><P
>Essentially, bits set in the <TT
CLASS="PARAMETER"
><I
>force security mode
	</I
></TT
> parameter may be treated as a set of bits that, when 
	modifying security on a file, the user has always set to be 'on'.</P
><P
>If not set explicitly this parameter is set to the same value 
	as the <A
HREF="smb.conf.5.html#FORCECREATEMODE"
TARGET="_top"
><TT
CLASS="PARAMETER"
><I
>force 
	create mode</I
></TT
></A
> parameter to provide compatibility
	with Samba 2.0.4 where the permission change facility was introduced.
	To allow a user to modify all the user/group/world permissions on a file
	with no restrictions set this parameter to 000.</P
><P
>The <TT
CLASS="PARAMETER"
><I
>security mask</I
></TT
> and <TT
CLASS="PARAMETER"
><I
>force 
	security mode</I
></TT
> parameters are applied to the change 
	request in that order.</P
><P
>For a directory Samba will perform the same operations as 
	described above for a file except using the parameter <TT
CLASS="PARAMETER"
><I
>	directory security mask</I
></TT
> instead of <TT
CLASS="PARAMETER"
><I
>security 
	mask</I
></TT
>, and <TT
CLASS="PARAMETER"
><I
>force directory security mode
	</I
></TT
> parameter instead of <TT
CLASS="PARAMETER"
><I
>force security mode
	</I
></TT
>.</P
><P
>The <TT
CLASS="PARAMETER"
><I
>directory security mask</I
></TT
> parameter 
	by default is set to the same value as the <TT
CLASS="PARAMETER"
><I
>directory mask
	</I
></TT
> parameter and the <TT
CLASS="PARAMETER"
><I
>force directory security 
	mode</I
></TT
> parameter by default is set to the same value as 
 	the <TT
CLASS="PARAMETER"
><I
>force directory mode</I
></TT
> parameter to provide 
	compatibility with Samba 2.0.4 where the permission change facility 
	was introduced.</P
><P
>In this way Samba enforces the permission restrictions that 
	an administrator can set on a Samba share, whilst still allowing users 
	to modify the permission bits within that restriction.</P
><P
>If you want to set up a share that allows users full control
	in modifying the permission bits on their files and directories and
	doesn't force any particular bits to be set 'on', then set the following
	parameters in the <A
HREF="smb.conf.5.html"
TARGET="_top"
><TT
CLASS="FILENAME"
>smb.conf(5)
	</TT
></A
> file in that share specific section :</P
><P
><TT
CLASS="PARAMETER"
><I
>security mask = 0777</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force security mode = 0</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>directory security mask = 0777</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force directory security mode = 0</I
></TT
></P
><P
>As described, in Samba 2.0.4 the parameters :</P
><P
><TT
CLASS="PARAMETER"
><I
>create mask</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force create mode</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>directory mask</I
></TT
></P
><P
><TT
CLASS="PARAMETER"
><I
>force directory mode</I
></TT
></P
><P
>were used instead of the parameters discussed here.</P
></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="AEN1755"
></A
>11.7. Interaction with the standard Samba file attribute 
	mapping</H1
><P
>Samba maps some of the DOS attribute bits (such as "read 
	only") into the UNIX permissions of a file. This means there can 
	be a conflict between the permission bits set via the security 
	dialog and the permission bits set by the file attribute mapping.
	</P
><P
>One way this can show up is if a file has no UNIX read access
	for the owner it will show up as "read only" in the standard 
	file attributes tabbed dialog. Unfortunately this dialog is
	the same one that contains the security info in another tab.</P
><P
>What this can mean is that if the owner changes the permissions
	to allow themselves read access using the security dialog, clicks
	<B
CLASS="COMMAND"
>"OK"</B
> to get back to the standard attributes tab 
	dialog, and then clicks <B
CLASS="COMMAND"
>"OK"</B
> on that dialog, then 
	NT will set the file permissions back to read-only (as that is what 
	the attributes still say in the dialog). This means that after setting 
	permissions and clicking <B
CLASS="COMMAND"
>"OK"</B
> to get back to the 
	attributes dialog you should always hit <B
CLASS="COMMAND"
>"Cancel"</B
> 
	rather than <B
CLASS="COMMAND"
>"OK"</B
> to ensure that your changes 
	are not overridden.</P
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="integrate-ms-networks.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="samba-howto-collection.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="pam.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Integrating MS Windows networks with Samba</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="p1346.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Configuring PAM for distributed but centrally 
managed authentication</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>